{

uint64_t n = 0;

WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN

for (uint32_t* edge = edgesStart; edge < edgesStop && n < MAX_EDGES; edge++)

*edge = ++n;

WTF_ALLOW_UNSAFE_BUFFER_USAGE_END

{

unsigned action;

READ_FROM_FUZZILLI(&action, sizeof(action));

RELEASE_ASSERT_WITH_MESSAGE(action == 'cexe', "[REPRL] Unknown action: %u", action);

{

RELEASE_ASSERT_WITH_MESSAGE(!edgesStart && !edgesStop, "Coverage instrumentation is only supported for a single module");

edgesStart = start;

edgesStop = stop;

if (const char* shmKey = getenv("SHM_ID")) {

int32_t fd = shm_open(shmKey, O_RDWR, S_IREAD | S_IWRITE);

RELEASE_ASSERT_WITH_MESSAGE(fd >= 0, "Failed to open shared memory region: %s", strerror(errno));

sharedData = static_cast<SharedData*>(mmap(0, SHM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0));

RELEASE_ASSERT_WITH_MESSAGE(sharedData != MAP_FAILED, "Failed to mmap shared memory region");

dataLogLn("[COV] edge counters initialized. Shared memory: %s with %zu edges.", shmKey, edgesStop - edgesStart);

} else

sharedData = static_cast<SharedData*>(malloc(SHM_SIZE));

resetCoverageEdges();

sharedData->numEdges = static_cast<uint32_t>(edgesStop - edgesStart);

{

size_t inputSize;

READ_FROM_FUZZILLI(&inputSize, sizeof(inputSize));

RELEASE_ASSERT(inputSize < REPRL_MAX_DATA_SIZE);

buffer->resize(inputSize);

memcpySpan(buffer->mutableSpan(), unsafeMakeSpan(reprlInputData, inputSize));

{

// In REPRL mode, stdout and stderr may be regular files, so we need to fflush them here.

fflush(stdout);

fflush(stderr);

// Check if any rejected promises weren't handled.

if (numPendingRejectedPromises > 0) {

numPendingRejectedPromises = 0;

result = 1;

}

int32_t status = (result & 0xff) << 8;

WRITE_TO_FUZZILLI(&status, sizeof(status));

resetCoverageEdges();

{

std::array<char, 4> helo { 'H', 'E', 'L', 'O' };

WRITE_TO_FUZZILLI(helo.data(), helo.size());

READ_FROM_FUZZILLI(helo.data(), helo.size());

RELEASE_ASSERT_WITH_MESSAGE(equalSpans(std::span { helo } , "HELO"_span), "[REPRL] Invalid response from parent");

// Mmap the data input buffer.

reprlInputData = static_cast<char*>(mmap(0, REPRL_MAX_DATA_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, REPRL_DRFD, 0));

RELEASE_ASSERT(reprlInputData != MAP_FAILED);

{

// Avoid duplicate initialization.

if (start == stop || *start)

return;

Fuzzilli::initializeCoverage(start, stop);

{

// There's a small race condition here: if this function executes in two threads for the same

// edge at the same time, the first thread might disable the edge (by setting the guard to zero)

// before the second thread fetches the guard value (and thus the index). However, our

// instrumentation ignores the first edge (see libcoverage.c) and so the race is unproblematic.

uint32_t index = *guard;

WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN

Fuzzilli::sharedData->edges[index / 8] |= 1 << (index % 8);

WTF_ALLOW_UNSAFE_BUFFER_USAGE_END

*guard = 0;